Bulk collection of telecommunications data on UK citizens may be permissible under EU law, according to a preliminary opinion issued from the European Court of Justice (ECJ). However, it can be used only to investigate "serious crimes".
The opinion relates to a case being heard by the ECJ brought by UK ministers including David Davis, head of the new Department for Exiting the European Union, filed in the wake of the 2014 Data Retention and Investigatory Powers Act (DRIPA).
The ministers contend that the elements of DRIPA that require telecoms firm to keep metadata, such as the time, data, location and duration of messages sent over their networks, although not the content, is too broad.
Specifically, the MPs, which also include deputy leader for the Labour Party Tom Watson, argue that it infringes on the right to privacy enshrined in the EU
Charter of Fundamental Rights.
However, a preliminary opinion issued by EU advocate general Saugmandsgaard Øe said that requiring data to be retained for the pursuit of serious crime could be compatible with EU law, but with caveats.
“The advocate general is of the opinion that a general obligation to retain data may be compatible with EU law. The action by member states against the possibility of imposing such an obligation is, however, subject to satisfying strict requirements,” he wrote.
Øe explained that it is down to the national courts in each member state to determine how this is interpreted, and that it must be done with strict safeguards and focused only on serious crime, not “ordinary offences”.
“The general obligation to retain data must be proportionate, in a democratic society, to the objective of the fight against serious crime, which means that the serious risks engendered by that obligation in a democratic society must be proportionate to the advantages it offers in the fight against serious crime,” he said.
This could have huge implications for the development of the Investigatory Powers Bill, currently being debated in the House of Lords, by putting limits on what data can be gathered, and for what purpose it can be used.
The opinion did defend some elements of bulk collection, but Watson welcomed the position. The Guardian reported Watson as saying that it proved the DRIPA powers introduced by then home secretary and current prime minister Theresa May were too broad.
“This legal opinion shows the prime minister was wrong to pass legislation when she was home secretary that allows the state to access huge amounts of personal data without evidence of criminality or wrongdoing,” he said.
“The opinion makes it clear that information including browsing history and phone data should not be made available to the security services and other state bodies without independent authorisation.”
The opinion issued by the EU attorney general is not binding, and the court could make a different ruling, although it is rare for this to happen.
One notable time that it did, however, was when the ECJ ruled that EU citizens have a right to be forgotten and could request the removal of certain results from search engines, contradicting the opinion of the attorney general in that case who ruled that they did not.
Australian government to require technology and communications companies to provide access to messages
New bill avoids demanding 'backdoors' in encryption, but includes measures to compel companies to provide access to encrypted communications
Indonesian overclocker Ivan Cupa (with the aid of a lot of liquid nitrogen) achieves record overclock on AMD's latest Threadripper
Ssupermassive black hole is so big it corresponds to four per cent of the galaxy's total mass
Imminent attack will target a single bank with cloned cards used to fraudulently withdraw millions over one weekend